Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 cf1127e4d3edbdfe…

MALICIOUS

Office (OOXML) / .XLSX

1.18 MB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-04-04
MD5: d002e8223ec57a855e9eac04e256261f SHA-1: 318a1f7d603b0a0b33ecc91c821aaba2786fff0d SHA-256: cf1127e4d3edbdfee396fa26c787fa244777ffa40e6bc1568748300fe6c97bb9
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as malicious by ClamAV with the signature 'Xls.Downloader.GreenOffice12210-9918618-0'. Static analysis reveals the presence of multiple Excel 4.0 macro sheets embedded within the XLSX file. These macros are indicative of a downloader, likely intended to fetch and execute additional malicious content.

Heuristics 3

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
  • ClamAV: Xls.Downloader.GreenOffice12210-9918618-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.GreenOffice12210-9918618-0

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
emf_00.emf
2c0213aa878887acec1e7eedb2c6086461c3401e573fb6b726ccdd96949348cc		 ooxml-emf OOXML EMF part: xl/media/image1.emf 3183416 bytes
xlm_sheet_00.bin
a5aea42b55eb31e989a4891bbc24d3b8e06195d7fc76a0e8d836081de12f2463		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 431 bytes
xlm_sheet_01.bin
b4b88d290feba226d312fee99ae6e2cfbeb31f5cdbccfb18a0746f9de2d49206		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin 896 bytes
xlm_sheet_02.bin
906fcdb6ef2fc0f88e80199960798adad437e772fda86332bc9704e7fa946c04		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.bin 1188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.